What is GHSA-j4fh-9p52-f987?

GHSA-j4fh-9p52-f987 is a security advisory published by GitHub Security Advisories with High severity. Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling...

Which CVE IDs does GHSA-j4fh-9p52-f987 cover?

GHSA-j4fh-9p52-f987 covers the following CVE IDs: CVE-2026-56703. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j4fh-9p52-f987?

GHSA-j4fh-9p52-f987 has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-j4fh-9p52-f987HighCVSS 7.2

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling...

Vendor

GitHub Security Advisories

Published

August 25, 2026

Last Modified

August 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-56703 →

📋 Description

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

🔗 References (4)

https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf
https://nvd.nist.gov/vuln/detail/CVE-2026-56703
https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-sqlite-vacuum-into
https://github.com/advisories/GHSA-j4fh-9p52-f987